| Because of the diversity and difference of industrial Internet access devices,it is difficult to maintain and vulnerable to attacks.Traditional intrusion detection systems can detect few types of attacks and there is redundancy in network traffic data,resulting in poor classification performance.Therefore,this paper researches intrusion detection of industrial Internet based on double feature selection and Stacking method.The main work is as follows.Firstly,problems existing in the current intrusion detection are analyzed.Based on that,the intrusion detection model framework based on dual feature selection and Stacking is proposed and designed.Related techniques and evaluation indicators used in the model research are described.Secondly,in order to reduce the dimension of data,a feature de-correlation method based on Pearson correlation coefficient is proposed.The method based on Light GBM integration is used to remove redundant features through feature importance analysis,and the feature subset is optimized.In order to reduce unnecessary system overhead,a dual feature selection method based on feature de-correlation and Light GBM integration is proposed to generate an optimal feature subset.Thirdly,in order to better and stably improve the performance of the intrusion detection system,this paper proposes a two-level Stacking ensemble learning method based on MLP.The method is a two-level hierarchical structure.The first layer integrates classifies different tree structures and inputs the predicted results into the MLP learning tool of the second layer.The abnormal traffic is classified and predicted by the ensemble learning method of tree classifier and neural network.Finally,experimental research is carried out according to the method proposed in this paper.Experimental results show that the proposed dual feature selection method can effectively filter irrelevant and redundant features and reduce resource consumption.The anomaly detection method based on Stacking can classify network traffic behaviors and effectively improve the identification accuracy of the intrusion detection system.The validity and portability of the proposed method are verified in the real industrial Internet data set CSE-CIC-IDS2018. |
